CVE-2025-54571
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
CVE-2025-54571- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-252
- Updated
- 2026-11-02
EUVDEUVD-2025-23662
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
EUVD-2025-23662- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
CVE-2025-54571- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-252, CWE-79
- Updated
- 2026-11-02
OSV
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
CVE-2025-54571- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-252
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-54571
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
DEBIAN-CVE-2025-54571- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2012
mod_security security update
Security Fix(es):
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.(CVE-2025-54571)
- Record
OESA-2025-2012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 13 moreShow less
OSVOESA-2025-2013
mod_security security update
Security Fix(es):
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.(CVE-2025-54571)
- Record
OESA-2025-2013- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-2014
mod_security security update
Security Fix(es):
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.(CVE-2025-54571)
- Record
OESA-2025-2014- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-2015
mod_security security update
Security Fix(es):
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.(CVE-2025-54571)
- Record
OESA-2025-2015- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-2016
mod_security security update
Security Fix(es):
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.(CVE-2025-54571)
- Record
OESA-2025-2016- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2025-2062
mod_security security update
Security Fix(es):
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.(CVE-2025-54571)
- Record
OESA-2025-2062- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-54571
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
UBUNTU-CVE-2025-54571- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-66087 No score
CVE-2025-54571 affecting package mod_security 2.9.7-8
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
AZL-66087- Updated
- 2026-11-05
OSVAZL-66111 No score
CVE-2025-54571 affecting package mod_security 2.9.4-1
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
AZL-66111- Updated
- 2026-11-02
OSVBIT-modsecurity-2025-54571 No score
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
BIT-modsecurity-2025-54571- Updated
- 2026-11-02
OSVBIT-modsecurity2-2025-54571 No score
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Record
BIT-modsecurity2-2025-54571- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15456-1 No score
apache2-mod_security2-2.9.12-1.1 on GA media
These are all security issues fixed in the apache2-mod_security2-2.9.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15456-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03422-1 No score
Security update for apache2-mod_security2
This update for apache2-mod_security2 fixes the following issues:
- CVE-2025-54571: Fixed insufficient return value handling on modsecurity leads to xss and source code disclosure (bsc#1247674)
- Record
SUSE-SU-2025:03422-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03423-1 No score
Security update for apache2-mod_security2
This update for apache2-mod_security2 fixes the following issues:
- CVE-2025-54571: Fixed insufficient return value handling on modsecurity leads to xss and source code disclosure (bsc#1247674)
- Record
SUSE-SU-2025:03423-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mod_securityAzure Linux:3 |
through 2.9.7-8 | None known |
mod_securityAzure Linux:2 |
through 2.9.4-1 | None known |
modsecurityBitnami |
before 2.9.12 | 2.9.12 |
modsecurity2Bitnami |
before 2.9.12 | 2.9.12 |
modsecurity-apacheDebian:12 |
before 2.9.7-1+deb12u2, plus listed versions 2.9.7-12.9.7-1+deb12u1 |
2.9.7-1+deb12u2 |
modsecurity-apacheDebian:13 |
before 2.9.11-1+deb13u1, plus listed versions 2.9.11-1 |
2.9.11-1+deb13u1 |
modsecurity-apacheDebian:14 |
before 2.9.12-2, plus listed versions 2.9.11-1 |
2.9.12-2 |
modsecurity-apacheDebian:11 |
before 2.9.3-3+deb11u5, plus listed versions 2.9.3-32.9.3-3+deb11u12.9.3-3+deb11u22.9.3-3+deb11u32.9.3-3+deb11u4 |
2.9.3-3+deb11u5 |
mod_securityopenEuler:24.03-LTS |
before 2.9.12-1.oe2403 | 2.9.12-1.oe2403 |
mod_securityopenEuler:24.03-LTS-SP1 |
before 2.9.12-1.oe2403sp1 | 2.9.12-1.oe2403sp1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_securityopenEuler:24.03-LTS-SP2 |
before 2.9.12-1.oe2403sp2 | 2.9.12-1.oe2403sp2 |
mod_securityopenEuler:22.03-LTS-SP3 |
before 2.9.12-1.oe2203sp3 | 2.9.12-1.oe2203sp3 |
mod_securityopenEuler:22.03-LTS-SP4 |
before 2.9.12-1.oe2203sp4 | 2.9.12-1.oe2203sp4 |
mod_securityopenEuler:20.03-LTS-SP4 |
before 2.9.12-1.oe2003sp4 | 2.9.12-1.oe2003sp4 |
apache2-mod_security2SUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.9.4-150400.3.12.1 | 2.9.4-150400.3.12.1 |
apache2-mod_security2SUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.9.4-150400.3.12.1 | 2.9.4-150400.3.12.1 |
apache2-mod_security2openSUSE:Leap 15.6 |
before 2.9.4-150400.3.12.1 | 2.9.4-150400.3.12.1 |
apache2-mod_security2SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 2.8.0-7.12.1 | 2.8.0-7.12.1 |
modsecurityUbuntu:20.04:LTS |
All versions, plus listed versions 3.0.3-13.0.4-13.0.4-1build1 |
None known |
modsecurityUbuntu:22.04:LTS |
All versions, plus listed versions 3.0.4-23.0.6-1 |
None known |
modsecurityUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.10-13.0.11-13.0.12-13.0.12-1.1build13.0.12-1.1build2 |
None known |
modsecurityUbuntu:25.10 |
All versions, plus listed versions 3.0.13-13.0.14-13.0.14-1build1 |
None known |
modsecurityUbuntu:26.10 |
All versions, plus listed versions 3.0.14-1build23.0.15-13.0.16-1 |
None known |
modsecurityUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.14-1build13.0.14-1build2 |
None known |
apache2-mod_security2openSUSE:Tumbleweed |
before 2.9.12-1.1 | 2.9.12-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-54571 is a medium vulnerability (CVSS 6.9) in Owasp Modsecurity, published August 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in modsecurity 2.9.12.
References
github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9v
lists.debian.org/debian-lts-announce/2025/09/msg00008.html
nvd.nist.gov/vuln/detail/CVE-2025-54571
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2025-54571
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2012
suse.com/support/update/announcement/2025/suse-su-202503422-1
bugzilla.suse.com/1247674
ubuntu.com/security/CVE-2025-54571
cve.org/CVERecord?id=CVE-2025-54571